How to Prepare for Cyber Essentials Certification
Cyber Nova AI helps you prepare for Cyber Essentials. It doesn't award or certify it. Follow the steps here to get ready, then apply for certification through an accredited Cyber Essentials body when you're set.
Cyber Essentials is a UK government-backed certification that shows your business takes cyber security seriously. For small businesses, getting certified means working through five practical security controls and demonstrating you have them in place.
This guide explains what Cyber Essentials involves, what each control means in plain English, and how to work through the steps, whether you have an IT team or not.
Cyber Nova AI is a free platform that guides you through the preparation. You can follow this guide and track your progress in the app.
What is Cyber Essentials?
Cyber Essentials is run by the UK government's National Cyber Security Centre (NCSC) and managed by IASME. It sets out a baseline of security controls that protect against the most common cyber attacks.
There are two levels:
- Cyber Essentials, a self-assessment. You complete a questionnaire and declare that your business meets the requirements. Costs from around £300.
- Cyber Essentials Plus, the same controls, but verified by an independent assessor through technical checks. Costs from around £1,500.
Most small businesses start with the self-assessment level. Once you've got that in place, Plus is a natural next step if your clients or insurers require it.
Certification is valid for 12 months. You renew annually.
The Five Controls
Cyber Essentials assesses five areas of your business. Here's what each one means in practice.
Firewalls
A firewall controls what traffic can enter and leave your network. Your internet router almost certainly has one built in. The requirement is that it's switched on and configured properly, not left on the factory default settings.
If your team connects to the internet through a business router or a managed network, you'll need to check that the firewall is active and that unnecessary services are turned off.
Secure Configuration
Devices and software come with default settings that often aren't secure. They're designed to make setup easy, not to protect you. Secure configuration means changing those defaults: setting your own passwords, disabling features you don't use, and making sure devices are set up with security in mind.
This applies to computers, laptops, mobile phones used for work, and any software your team runs.
User Access Control
Only give staff access to what they need to do their job. Administrator accounts (those with full control over a device or system) should only be used when necessary and only by people whose role requires them.
When a member of staff leaves, their accounts should be disabled promptly. Don't use shared passwords.
Malware Protection
Malware is software designed to damage or gain unauthorised access to your systems. Malware protection means having antivirus or endpoint protection in place on every device used for work, keeping it up to date, and making sure it's always switched on.
Most Windows devices include Microsoft Defender by default. If you use it, check that it's active and updating automatically.
Security Update Management
Software updates fix known vulnerabilities. Attackers routinely target businesses that haven't applied recent updates, because the fix already exists and they know it hasn't been installed.
Cyber Essentials requires you to install security updates within 14 days of release, and to remove or disable software that's no longer supported and no longer receiving updates.
This applies to your operating system, your apps, your browser, and any software your team uses for work.
What the Certification Process Looks Like
Step 1: Choose a certification body
Apply through an IASME-accredited certification body. You can find a list at iasme.co.uk. The cost for self-assessment (Cyber Essentials basic) starts from around £300.
Step 2: Define your scope
Scope means deciding what's included in your assessment: which devices, which cloud services, which users. For most small businesses, this is everything the team uses for work. You need to document this before starting the questionnaire.
Step 3: Complete the questionnaire
The current questionnaire is called the Danzell question set (Requirements v3.3, in force from 27 April 2026). It asks how you've addressed each of the five controls. Be accurate: the purpose is to identify gaps, not to pass at any cost.
Step 4: Fix any gaps before submitting
If the questionnaire reveals gaps, fix them before submitting. Common ones: 2FA not enabled, default passwords still in use, software not updated. Many businesses use the questionnaire itself as their preparation checklist.
Step 5: Receive your certificate
Once your answers are submitted and verified, you'll receive your Cyber Essentials certificate. It's valid for 12 months.
Common Questions
Do I need an IT team to get Cyber Essentials?
No. Cyber Essentials is designed to be achievable for small businesses without in-house IT support. Most of the requirements involve checking and adjusting settings on the devices and accounts your team already uses.
How long does it take?
It depends on your current setup. Businesses with good security habits already in place can often complete the preparation in a few weeks. Starting from scratch, allow four to eight weeks to work through the controls properly.
Does Cyber Nova AI issue Cyber Essentials certification?
No. Cyber Nova AI is a preparation and guidance tool. Certification itself is issued by IASME-accredited bodies after you complete the official process. Cyber Nova AI helps you get ready.
What does two-factor authentication have to do with Cyber Essentials?
Since version 3.3 (April 2026), two-factor authentication (2FA) is mandatory for cloud services under Cyber Essentials. If your team uses cloud email, cloud file storage, or any cloud business tool, 2FA must be switched on for all users before you can certify.
Read: how the April 2026 MFA requirement change works in practice →Related guides
Start Your Preparation with Cyber Nova AI
Cyber Nova AI is a free platform that breaks Cyber Essentials preparation into simple, trackable tasks. Plain English, no jargon, no IT team required. Work through the five CE controls step by step, track what you've completed, share progress with your team, and build the habits that support annual recertification.
Get started free